lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Sec: Sanitize all params page, sortfield and sortorder

Browse Source
This commit is contained in:
Laurent Destailleur 2012-10-13 14:47:46 +02:00
parent ac38954c17
commit 8ff506b120
11 changed files with 27 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/admin/tools/export.php
View File

@ -35,7 +35,7 @@ $file=GETPOST('filename_template','alpha');
$sortfield = GETPOST('sortfield','alpha');
$sortorder = GETPOST('sortorder','alpha');
$page = GETPOST("page");
$page = GETPOST("page",'int');
if (! $sortorder) $sortorder="DESC";
if (! $sortfield) $sortfield="date";
if ($page < 0) { $page = 0; }

4
htdocs/comm/action/index.php
View File

@ -42,8 +42,8 @@ $filterd = GETPOST("userdone","int",3)?GETPOST("userdone","int",3):GETPOST("filt
$showbirthday = empty($conf->use_javascript_ajax)?GETPOST("showbirthday","int"):1;
$sortfield = GETPOST("sortfield");
$sortorder = GETPOST("sortorder");
$sortfield = GETPOST("sortfield",'alpha');
$sortorder = GETPOST("sortorder",'alpha');
$page = GETPOST("page","int");
if ($page == -1) { $page = 0; }
$limit = $conf->liste_limit;

6
htdocs/compta/paiement.php
View File

@ -42,9 +42,9 @@ $socname = GETPOST('socname');
$accountid = GETPOST('accountid');
$paymentnum = GETPOST('num_paiement');
$sortfield = GETPOST('sortfield');
$sortorder = GETPOST('sortorder');
$page = GETPOST('page');
$sortfield = GETPOST('sortfield','alpha');
$sortorder = GETPOST('sortorder','alpha');
$page = GETPOST('page','int');
$amounts=array();
$amountsresttopay=array();

2
htdocs/contrat/services.php
View File

@ -35,7 +35,7 @@ $langs->load("companies");
$mode = GETPOST("mode");
$sortfield = GETPOST("sortfield",'alpha');
$sortorder = GETPOST("sortorder",'alpha');
$page = GETPOST("page");
$page = GETPOST("page",'int');
if ($page == -1) { $page = 0 ; }
$limit = $conf->liste_limit;
$offset = $limit * $page ;

4
htdocs/fourn/commande/liste.php
View File

@ -37,8 +37,8 @@ $sall=GETPOST('search_all');
$page = GETPOST('page','int');
$socid = GETPOST('socid','int');
$sortorder = GETPOST('sortorder');
$sortfield = GETPOST('sortfield');
$sortorder = GETPOST('sortorder','alpha');
$sortfield = GETPOST('sortfield','alpha');
// Security check
$orderid = GETPOST('orderid');

6
htdocs/fourn/facture/index.php
View File

@ -47,9 +47,9 @@ if ($user->societe_id > 0)
$mode=GETPOST("mode");
$modesearch=GETPOST("mode_search");
$page=GETPOST("page");
$sortorder = GETPOST("sortorder");
$sortfield = GETPOST("sortfield");
$page=GETPOST("page",'int');
$sortorder = GETPOST("sortorder",'alpha');
$sortfield = GETPOST("sortfield",'alpha');
if ($page == -1) { $page = 0 ; }
$limit = $conf->liste_limit;

6
htdocs/fourn/liste.php
View File

@ -45,9 +45,9 @@ $socid = GETPOST('socid','int');
if ($user->societe_id) $socid=$user->societe_id;
$result = restrictedArea($user,'societe',$socid,'');
$page = GETPOST('page');
$sortorder = GETPOST('sortorder');
$sortfield = GETPOST('sortfield');
$page = GETPOST('page','int');
$sortorder = GETPOST('sortorder','alpha');
$sortfield = GETPOST('sortfield','alpha');
if ($page == -1) { $page = 0 ; }
$offset = $conf->liste_limit * $page ;
$pageprev = $page - 1;

6
htdocs/holiday/index.php
View File

@ -33,9 +33,9 @@ require_once DOL_DOCUMENT_ROOT.'/holiday/common.inc.php';
// Protection if external user
if ($user->societe_id > 0) accessforbidden();
$sortfield = GETPOST("sortfield");
$sortorder = GETPOST("sortorder");
$page = GETPOST("page");
$sortfield = GETPOST("sortfield",'alpha');
$sortorder = GETPOST("sortorder",'alpha');
$page = GETPOST("page",'int');
$page = is_numeric($page) ? $page : 0;
$page = $page == -1 ? 0 : $page;

6
htdocs/product/stock/fiche.php
View File

@ -37,8 +37,8 @@ $langs->load("companies");
$action=GETPOST('action');
$sortfield = GETPOST("sortfield");
$sortorder = GETPOST("sortorder");
$sortfield = GETPOST("sortfield",'alpha');
$sortorder = GETPOST("sortorder",'alpha');
if (! $sortfield) $sortfield="p.ref";
if (! $sortorder) $sortorder="DESC";
@ -536,7 +536,7 @@ else
print '<center><br><input type="submit" class="button" value="'.$langs->trans("Save").'">&nbsp;';
print '<input type="submit" class="button" name="cancel" value="'.$langs->trans("Cancel").'"></center>';
print '</form>';
}

6
htdocs/product/stock/mouvement.php
View File

@ -48,9 +48,9 @@ $search_movement = isset($_REQUEST["search_movement"])?$_REQUEST["search_movemen
$search_product = isset($_REQUEST["search_product"])?$_REQUEST["search_product"]:'';
$search_warehouse = isset($_REQUEST["search_warehouse"])?$_REQUEST["search_warehouse"]:'';
$search_user = isset($_REQUEST["search_user"])?$_REQUEST["search_user"]:'';
$page = GETPOST("page");
$sortfield = GETPOST("sortfield");
$sortorder = GETPOST("sortorder");
$page = GETPOST("page",'int');
$sortfield = GETPOST("sortfield",'alpha');
$sortorder = GETPOST("sortorder",'alpha');
if ($page < 0) $page = 0;
$offset = $conf->liste_limit * $page;

6
htdocs/societe/societe.php
View File

@ -51,9 +51,9 @@ $search_categ=trim(GETPOST("search_categ"));
$mode=GETPOST("mode");
$modesearch=GETPOST("mode_search");
$sortfield=GETPOST("sortfield");
$sortorder=GETPOST("sortorder");
$page=GETPOST("page");
$sortfield=GETPOST("sortfield",'alpha');
$sortorder=GETPOST("sortorder",'alpha');
$page=GETPOST("page",'int');
if (! $sortorder) $sortorder="ASC";
if (! $sortfield) $sortfield="s.nom";
if ($page == -1) { $page = 0 ; }